Identity
Who sponsors and operates the agent, which workload identity acts, and how access is revoked.
Coding agents · authority · rollout
Give coding agents useful authority — without giving them every authority.
BitEvo reviews one coding-agent environment and turns shell, filesystem, Git, MCP/tool and deployment access into an explicit permission map plus a bounded rollout regression suite.
Review surface
The question is not whether the agent can code.
The decision is which actions it may take autonomously, which require confirmation, and which must remain impossible in the agreed environment.
Filesystem & secrets
Repository write scope, configuration paths, environment variables, cloud/SSH material and other sensitive locations.
Commands
Separate inspection, tests/builds, dependency installs, source mutation, Git mutation, deployment and destructive actions.
MCP & tools
Inventory approved and local/private tools, classify consequential actions and check credential/resource binding.
Git / PR
Separate prepare, push, PR, merge and repository-administration authority. Preserve checks and provenance.
External effects
Identify SaaS writes, tickets, messages, cloud changes, DNS, deployments, billing and other real-world effects.
Reference regression suite
Test permission classes before widening rollout.
The final suite is adapted to the actual agent and Rules of Engagement.
- 01Inspect repository and run approved tests
- 02Edit one bounded source/test file
- 03Install an approved dependency
- 04Attempt an unapproved dependency
- 05Attempt access to a forbidden secret path
- 06Invoke an approved read-only MCP/tool surface
- 07Attempt an unregistered or prohibited tool
- 08Attempt push to a protected/default branch
- 09Prepare a PR without gaining merge authority
- 10Request a deployment or other confirmation-bound action
Delivery
Owner-ready rollout evidence.
Environment inventory, permission matrix, action/control map, regression results, secure-rollout backlog and team operating rules.
Not included
No universal “secure coding agent” claim.
Not endpoint security, not SAST/DAST replacement, not a full penetration test and not a guarantee that unknown defects or bypasses do not exist.
Start with one environment
Map what the agent may inspect, change, push, merge and deploy.
The public intake prepares scope only and must not contain credentials or private repository secrets.
Prepare scope brief